CVE-2026-2357 in Bold Page Builder Plugin
Summary
by MITRE • 08/16/2026
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt_bb_shortcode' shortcode in all versions up to, and including, 5.6.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/16/2026
The Bold Page Builder plugin for WordPress represents a significant security risk through its vulnerability to stored cross-site scripting attacks affecting versions up to and including 5.6.8. This vulnerability exists within the plugin's bt_bb_shortcode functionality where insufficient input sanitization and output escaping mechanisms fail to properly validate user-supplied attributes. The flaw allows authenticated attackers who possess contributor-level access or higher privileges to inject malicious web scripts into pages that will execute whenever any user accesses those compromised pages. This creates a persistent threat vector that can affect all users who encounter the malicious content, regardless of their permission levels within the WordPress environment.
The technical exploitation of this vulnerability stems from inadequate validation processes within the plugin's shortcode handling mechanism. When user-supplied attributes are processed through the bt_bb_shortcode function without proper sanitization, malicious input can be stored within the WordPress database and subsequently executed in the context of other users' browsers. This represents a classic stored XSS attack pattern where the malicious payload persists in the application's data store rather than being reflected in a single request. The vulnerability specifically targets the plugin's handling of shortcode parameters, allowing attackers to inject script code that will execute in the browser contexts of unsuspecting visitors or administrators who view pages containing the compromised content.
From an operational impact perspective, this vulnerability enables attackers to escalate their privileges and compromise entire WordPress installations through persistent malicious scripts. Contributors and above can leverage this flaw to inject various types of malicious payloads including but not limited to cookie stealing scripts, redirecting users to phishing sites, or executing arbitrary commands on affected systems. The stored nature of the attack means that once a malicious shortcode is injected into a page, it continues to affect all users who access that content until the vulnerability is patched and the malicious code is removed from the database. This creates a sustained threat that can persist even after the initial attacker has left the system.
Security mitigation strategies must include immediate patching of the Bold Page Builder plugin to version 5.6.9 or later where the XSS vulnerabilities have been addressed through proper input sanitization and output escaping mechanisms. Administrators should also implement strict content validation policies for all user-contributed content and consider implementing web application firewalls that can detect and block suspicious shortcode parameters. The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws in web applications, and represents a clear violation of the principle of least privilege as it allows lower-privilege users to execute code at higher privilege levels through insecure input handling. Additionally, this vulnerability can be mapped to ATT&CK technique T1548.002 related to abuse of group privileges and T1059.001 for command and scripting interpreter usage, demonstrating how a seemingly minor plugin vulnerability can enable broader attack vectors within WordPress environments.
Organizations should conduct comprehensive audits of their WordPress installations to identify all instances of the vulnerable Bold Page Builder plugin and ensure that proper security measures are in place. Regular monitoring of user activity and content changes becomes critical when dealing with plugins that allow authenticated users to inject code into the system. The vulnerability also highlights the importance of input validation at multiple layers within web applications, as proper sanitization should occur both during data entry and before output rendering to prevent XSS attacks from propagating through the entire application stack.